T1518.001 Security Software Discovery

Technique: T1518.001
Tactics: Discovery
Research, 90 days: 6
KEV CVEs mapped: 0
SigmaHQ rules: 8
Elastic, Splunk: 4
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1518/001

MITRE description

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet (threat-hunting)
Security Software Discovery - Linux (core)
System Integrity Protection (SIP) Disabled (core)
System Integrity Protection (SIP) Enumeration (core)
Security Software Discovery - MacOs (core)
Security Software Discovery Via Powershell Script (core)
Security Tools Keyword Lookup Via Findstr.EXE (core)
Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE (core)

Elastic and Splunk rules

Security Software Discovery via Grep (elastic)
Deprecated - PowerShell Script with Discovery Capabilities (elastic)
Process Discovery via Built-In Applications (elastic)
Security Software Discovery using WMIC (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.